Extracted

• • Target
    gooddaycomingforu.hta
  • Size 971KB
  • SHA256 ea011650b55333961a5115ce93c0d7430b7d399fb44a0861ae72d6ffe4b5021a
  • MD5 4bf2a97b03e4dfe1d198ef2a1e6aebf1
  • SHA1 8045dbb436f89b3290507d88f1e61c8f48c5dae2
  • SHA512 5856a167d39659187c00a3f9c8ae08dfed66976f1dc0e251c902d24233423073566b859502473d83266b2721b3d298b770bdf86659eeed5db931273291674d71
  • SSDEEP 192:O9bFbGbH2bb0aMVWXbiK29oqWFu9fbbJs1GX+bbbb9UXbNQ9UTNZ5aibfiWnnXFk:obc8eg3cjTvqh
  • TLSH
    T1B825B0A1C7FA4218639432D5EC509554D22A440CB87A2F0CF76EE8E06CA17FDBBBDC65
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionbackdoorcollectionsmokeloaderpersistencetrojan

  • Detects Smokeloader version 2025 payload

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2